MGASA-2026-0257 Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the futimes function of lib/internal/fs/promises.js, which backs FileHandle.utimes and performs no file system permission check. An attacker who can execute code in a process running under the Permission...

Node.js: Permission Model bypass via FileHandle.utimes() in the promises API

Vulnerability description not provided...